Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Microsoft 365 Scam and Kali365 Toolkit Hack
Microsoft 365 Scam and Kali365 Toolkit Hack

The Federal Bureau of Investigation (FBI) has issued an urgent warning regarding a widespread Microsoft 365 phishing scam driven by a malicious hacking toolkit called "Kali365". This dangerous scam relies on tricking users into entering an authorization code on a real Microsoft webpage. This action allows hackers to completely bypass passwords and multi-factor authentication (MFA) to hijack Outlook, Teams, and OneDrive accounts.

How the Kali365 Scam Works

  1. The Phishing Email: You receive an urgent email that mimics a standard document-sharing service like SharePoint or OneDrive.
  2. The Real Website, Fake Code: The message instructs you to go to a legitimate, real Microsoft website and enter a specific "device code" provided in the email.
  3. The Trap: Because the website is a real Microsoft page, users think it is safe. However, typing that code approves a login request for the hacker's device.
  4. Token Theft: The automated tool steals your login token. The scammer gains permanent access to your emails and files without ever knowing your password.

Other Common Microsoft 365 Scams

  • Fake Renewal Bills: Emails claiming your Microsoft 365 subscription expired. They ask for credit card numbers on fake payment pages.
  • Storage Full Alerts: Messages warning that your OneDrive is 100% full. They threaten to delete your files if you do not click their link.
  • Tech Support Pop-ups: Scary browser pop-ups with a phone number. They claim your computer is locked or has a virus.

Signs of a Scam

  • An unexpected request to enter a login or device code.
  • High urgency language demanding immediate action.
  • Links pointing to strange domains like "office365family.com" instead of the official microsoft.com.
  • Demands for money or credit card updates through attached files.

How to Protect Yourself

  • Never enter a device code that you did not personally request.
  • Check your Microsoft account security page regularly to review active login sessions and unfamiliar devices.
  • Avoid clicking links inside unexpected billing or document notifications.
  • Forward suspicious emails as attachments to the official Microsoft phishing team at phish@office365.microsoft.com.
  • Report any scam attempts or losses directly to the FBI's Internet Crime Complaint Center (IC3).
waiting